fc9c63f776e38a39e843b69a46353d80_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc9c63f776e38a39e843b69a46353d80_JaffaCakes118
Size

80KB
MD5

fc9c63f776e38a39e843b69a46353d80
SHA1

505c366b14a39bc02cca6ea53273a603fe64af7d
SHA256

73fa35362532ee6ea2d484f8cab7a6b483e2baee9a9232806a5bfe1a6f592f5a
SHA512

9316f750c55e4b85d4d3e993180bd2d8d2f76a3468c3ad7743f3d30d90351dd21763ee6b31566005a8e73bef059deb325d6bade36bafd96e39e8c25911ff0706
SSDEEP

1536:rXgePkoXO4GMo4ctx4Y8Kz0BoKlpdvPCFaycNs:sskoXd6bzuocp8H/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc9c63f776e38a39e843b69a46353d80_JaffaCakes118

Files

fc9c63f776e38a39e843b69a46353d80_JaffaCakes118
.exe windows:4 windows x86 arch:x86

82ca05b84f1b01b28595c96371836edc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
GetProcAddress
LoadLibraryA
ExitProcess
VirtualProtect
VirtualAlloc
VirtualQuery
GetStringTypeA
LCMapStringW
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
WriteFile
HeapAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
GetStringTypeW

user32

MessageBoxA

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE